Allow X-Access-Token header